Virtual Network Interface Bridging Secure Vsock VM Data Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application programs deployed in virtual machines face challenges in data transmission with other virtual machines due to reliance on network interfaces, leading to difficulties in adapting to virtualized security environments and slowing the promotion of confidential computing.
Innovation Solution
A data channel building method that establishes a virtual network interface in the EVM, utilizing a virtual network device and secure vsock communication to enable data transmission with the PVM, allowing application programs to use network communication without modification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application programs use network interface for data transmission, then data transmission capability is improved, but adaptability to virtualized security environment deteriorates
Solution Approach 1:
The patent introduces a virtual network interface as an intermediary layer between the application program and the vsock communication mechanism. This virtual interface allows applications to use standard network interfaces while the virtualization layer translates these into vsock communications, resolving the conflict between network interface compatibility and virtualized security environment requirements
Solution Approach 2:
The patent segments the communication architecture into multiple layers: the application layer using standard network interfaces, a virtualization layer with virtual network interfaces, and the underlying vsock communication layer. This segmentation allows each layer to operate independently with its own optimization, maintaining application compatibility while enabling secure virtualized communication
2Reliability
If virtual machines communicate only through local secure channels, then security is improved, but ease of operation deteriorates
Solution Approach 1:
The virtual network interface acts as a mediator that presents a familiar network interface API to application programs while translating communications into secure vsock channels underneath. This allows applications to operate with standard network programming interfaces without needing to understand or implement secure channel protocols directly
Solution Approach 2:
The patent creates a virtual copy of the network interface within the virtual machine environment. This virtual network interface replicates the functionality and API of physical network interfaces, allowing applications to interact with it exactly as they would with physical interfaces, while the underlying implementation uses secure vsock channels
3Ease of operation
If virtual machines use standard network interfaces, then ease of operation is improved, but device complexity deteriorates
Solution Approach 1:
The patent merges multiple functions into the virtual network interface: it provides standard network interface functionality to applications, implements vsock communication protocol translation, and manages security channel connections. This consolidation reduces the number of separate components needed while maintaining ease of operation for applications
Data Source
AI summary
Embodiments of the present application provides a data channel building method and an apparatus, where the data channel building method is applied to a second virtual machine running in a first virtual machine, including: determining a first data transmission interface of the first virtual machine and a second data transmission interface for data transmission with the first virtual machine, where the first data transmission interface is communicated with the second data transmission interface; determining module information of a virtual network module according to attribute information of the second data transmission interface; generating the virtual network module according to the module information of the virtual network module; and building a target data transmission channel according to the first data transmission interface, the second data transmission interface and the virtual network module.